Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 20

Question 190

A security auditor needs to know which role used GetObject against individual S3 objects last week. The default CloudTrail management event log shows bucket configuration changes but not object reads. Which additional event collection is needed?

Configure CloudTrail S3 object-level data events for the intended bucket/object scope and verify the recorded caller identity and operation.
Enable only management events again and expect them to include all object reads.
Turn on S3 server access logging only and assume it records the full CloudTrail IAM session caller, role issuer and API parameters for every individual GetObject.
Change the object storage class to Standard-IA and assume read events appear automatically.

Explanation

Correct Answer

GetObject is a data-plane operation; CloudTrail data events are not generally logged by default and must be explicitly selected and priced.

Incorrect Answers

Management events concern control-plane actions and do not replace S3 object data event selection.

S3 server access logs differ from CloudTrail S3 data-event records and may not provide the full request principal/event context required. Explicit CloudTrail object data events support the requested API attribution.

Storage classes determine price and retrieval behavior, not CloudTrail event configuration.

Question 191

A disaster recovery plan needs an encrypted EBS snapshot copied to another AWS Region while retaining controlled key authorization in the destination. What is a valid procedure?

Copy the EBS snapshot to the target Region with appropriate supported encryption/KMS key choices and permissions, then verify restoration.
Change the source EBS volume’s Availability Zone and assume its snapshot automatically becomes a regional copy.
Share an EBS snapshot from its source Region with the recovery account while leaving all destination-region snapshot copies and KMS permissions absent.
Rely on CloudFront caching of EBS blocks as the recovery point.

Explanation

Correct Answer

EBS snapshot copies can be encrypted or re-encrypted using a destination-region KMS key; a regional snapshot needs an explicit cross-Region copy.

Incorrect Answers

Changing AZ placement is not a cross-Region snapshot-copy operation.

Snapshot sharing can authorize another account in a Region but does not itself create a destination-region recovery artifact. A cross-Region copy and destination key authorization remain necessary.

A CDN cache is not a restorable EBS snapshot.

Question 192

An auditor wants continuous detection when new EBS volumes are created without the required encryption configuration. Which AWS-native compliance evaluation service can test the resource state?

Use CloudTrail event history only and assume it continuously grades every volume encryption state.
Use a suitable AWS Config managed or custom rule that evaluates volume encryption and records noncompliant resources.
Monitor CloudTrail CreateVolume API calls for encryption parameters but never evaluate the resulting resources against a configured compliance rule.
Use S3 Intelligent-Tiering to change EBS volume encryption.

Explanation

Correct Answer

AWS Config evaluates supported resource configurations against rules; detecting encryption drift differs from provisioning encrypted storage.

Incorrect Answers

API audit evidence is useful but is not the same as a configuration compliance rule evaluation.

CloudTrail can reveal who requested an API operation but does not continuously assess the resource configuration state. AWS Config rules are appropriate for noncompliant-at-rest encryption findings.

S3 storage classes cannot enforce EBS-at-rest encryption.

Question 193

A DynamoDB application occasionally overwrites records incorrectly, and operators need to recover the data to a chosen minute within a retention window. Which protection best supports this?

Enable DynamoDB point-in-time recovery and restore the chosen valid point to a new table for validation and cutover.
Run a once-a-month on-demand backup and assume it allows arbitrary minute-level restores.
Enable global tables and assume they retain every pre-overwrite item version indefinitely.
Enable DynamoDB Streams and assume the change stream is a durable, arbitrary-second point-in-time restore store for the past several weeks.

Explanation

Correct Answer

DynamoDB PITR maintains continuous recoverable history and restores into a new table, unlike one static scheduled daily snapshot.

Incorrect Answers

An on-demand backup preserves a single point, not continuous minute-by-minute history.

Replication may propagate bad writes; global tables do not substitute for PITR.

Streams provide a bounded change-record history for consumers, not a general PITR mechanism with restore-to-new-table semantics and a configurable recovery window.

Question 194

An internal enterprise uses AWS Private CA certificates in services whose endpoints do not automatically support ACM managed installation and renewal. What must the design account for?

Assume every third-party appliance automatically installs renewed ACM private certificates.
Configure ACM private-certificate issuance but leave certificate installation and renewal on every unmanaged appliance manual and untested.
Implement compatible certificate deployment and renewal for the private endpoints, including CA trust distribution, rather than assuming all ACM private certificates are auto-installed.
Configure an IAM root password as a replacement for a server certificate chain.

Explanation

Correct Answer

Private CA issues certificates but application integration and endpoint renewal may require explicit automation and trust-chain lifecycle controls.

Incorrect Answers

Automatic managed integration depends on the target service; arbitrary appliances may not fetch renewed certificates.

Issuance alone does not update external service endpoints or validate their trust chain. A compatible automated delivery/renewal integration is required.

Identity credentials are not X.509 server trust chains.

Question 195

A storage audit needs a complete inventory of S3 object keys and configuration metadata plus a separate classification of likely PII inside selected objects. Which pairing supplies both?

Use S3 Inventory for scheduled object metadata and Macie sensitive-data discovery for supported object-content inspection.
Use S3 Inventory alone because it reads every file body and labels all PII.
Use Macie alone as the exact substitute for every object metadata inventory report.
Enable only CloudTrail S3 data events and treat records of object reads as a monthly sensitive-content classification of every stored PDF.

Explanation

Correct Answer

Inventory supplies key/size/encryption/version metadata while Macie analyzes selected supported content for sensitive information.

Incorrect Answers

Inventory does not perform full semantic content classification.

Macie focuses on sensitive data discovery, not every inventory field and object inventory requirement.

CloudTrail reports access behavior, not the actual personal data found within object contents. Use Macie or another supported content-scanning workflow alongside Inventory metadata.

Question 196

Two external vendors upload into a company-controlled S3 bucket. Security wants policy-based access controlled by the destination owner, with no uploader-maintained ACLs. Which feature governs ownership?

Configure S3 Object Ownership Bucket owner enforced and use bucket/IAM policies for authorized uploads and reads.
Use default Object writer ownership so each uploader controls the ACLs indefinitely.
Use S3 bucket owner preferred mode without requiring every supplier to send bucket-owner-full-control ACLs on their uploads.
Give each vendor full access to all bucket policies and account roots.

Explanation

Correct Answer

Bucket owner enforced disables ACLs as access controls and makes the destination bucket owner own newly uploaded objects.

Incorrect Answers

This fails the owner-controlled policy requirement.

Bucket owner preferred ownership is conditional on the canned ACL; if suppliers omit it, their object ACL/ownership may still matter. Bucket owner enforced removes the dependence.

Unrestricted vendor privileges are unnecessary and unsafe.

Question 197

An S3 application has an IAM s3:GetObject allowance but fails to read an SSE-KMS object. The KMS key policy excludes its role. What boundary is missing?

The object must be renamed to match the IAM role.
Grant the external role s3:GetObject on the protected object but omit KMS authorization, assuming successful S3 IAM evaluation implies key-policy access.
Any role allowed S3 GetObject bypasses KMS key policies.
KMS authorization for the role to use the encrypting key, independently of S3 object read authorization.

Explanation

Correct Answer

SSE-KMS reads need effective KMS cryptographic permission; S3 GetObject alone is not proof of key access.

Incorrect Answers

Object names do not grant KMS decrypt permissions.

S3 object authorization and customer-managed KMS decryption are independent checks. The role needs effective permission for the encrypting key as well as the object.

KMS retains its independent authorization checks.

Question 198

A security engineer claims SSE-S3 will allow customer-controlled key deletion and per-key key-policy audits. Which assumption is incorrect?

SSE-S3 cannot encrypt stored S3 objects.
HTTPS to S3 requires a customer managed KMS key.
SSE-KMS always makes every bucket anonymously readable.
SSE-S3 does not expose customer-managed KMS key policy and lifecycle controls; SSE-KMS with a customer managed key fits those needs.

Explanation

Correct Answer

Both encrypt S3 data, but only the KMS path provides separately managed customer key policies and key events.

Incorrect Answers

SSE-S3 is a valid server-side encryption mechanism.

Transport security and server-side key choice are independent.

Encryption configuration does not automatically grant public object access.

Question 199

An external analyst can retrieve a KMS-encrypted report, and the KMS key policy names its AWS account. Decrypt still returns an authorization error because the analyst role has no matching IAM permission. Why?

The key owner’s policy automatically attaches IAM permissions to external roles.
Cross-account KMS use requires the external role’s effective IAM allowance in addition to the key-owner policy grant.
Grant the analyst kms:Decrypt in an external IAM identity policy but assume the key-owning account automatically delegates use based only on a matching account ARN string.
S3 storage class selects which principal may call KMS.

Explanation

Correct Answer

The key owner can allow external account use, but that account still chooses which principals can perform the cryptographic API action.

Incorrect Answers

A KMS key policy cannot edit an external role identity policy.

External IAM permission alone cannot make a cross-account KMS key usable; the key-owner policy must authorize the relevant external account/role and operations as well.

Object tier does not replace KMS identity permissions.

Question 200

After AWS KMS automatically rotates symmetric key material, an application can still decrypt a ciphertext created months earlier. The team thinks rotation should destroy old key versions. Why does it still work?

KMS retains historical key material for the same key and selects the version needed to decrypt old ciphertext.
All KMS rotation immediately rewrites every existing S3 object with the new material.
The application must have disabled KMS to make old ciphertext readable.
Re-encrypt every encrypted object through an S3 Batch job after automatic KMS rotation, assuming older ciphertext cannot use retained material.

Explanation

Correct Answer

Automatic rotation introduces new material for future encryption without changing the key identity or intentionally losing access to earlier ciphertext.

Incorrect Answers

Rotation of backing key material is not equivalent to re-encrypting stored objects.

Supported decrypt uses retained KMS material while respecting permissions.

Bulk re-encryption may be a separate business decision but is not required simply because KMS rotates backing material. KMS uses retained previous key versions to decrypt old ciphertext.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 190

Explanation

Correct Answer

Incorrect Answers

Question 191

Explanation

Correct Answer

Incorrect Answers

Question 192

Explanation

Correct Answer

Incorrect Answers

Question 193

Explanation

Correct Answer

Incorrect Answers

Question 194

Explanation

Correct Answer

Incorrect Answers

Question 195

Explanation

Correct Answer

Incorrect Answers

Question 196

Explanation

Correct Answer

Incorrect Answers

Question 197

Explanation

Correct Answer

Incorrect Answers

Question 198

Explanation

Correct Answer

Incorrect Answers

Question 199

Explanation

Correct Answer

Incorrect Answers

Question 200

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests